eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Threat Actors Exploit PAN-OS GlobalProtect Authentication Bypass Vulnerability
Bottom Line: Palo Alto Networks has confirmed that threat actors are actively targeting the GlobalProtect vulnerability CVE-2026-0257. Immediate remediation is recommended to limit the risk of opportunistic attacks.
On May 13th, 2026, Palo Alto Networks published an advisory for CVE-2026-0257, a vulnerability in the GlobalProtect portal and gateway of PAN-OS software. On May 29th, 2026, the advisory was updated to confirm that limited exploitation attempts had been observed. On the same day, the Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to remediate by June 1st, 2026.
CVE-2026-0257 (CVSS: 7.8) is an authentication bypass vulnerability in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software. Exploitation would allow the attacker to bypass security restrictions and establish an unauthorized VPN connection. In order for successful exploitation, GlobalProtect must be enabled with authentication override cookies configured alongside specific certificate settings; additionally, Panorama and Cloud Next-Generation Firewall (Cloud NGFW) are not impacted.
Researchers from Rapid7 reported early exploitation. According to the company, two waves of attacks were identified, both conducted by the same unspecified threat actor. The first wave, traced to May 17th, involved suspicious cookie authentication to local admin accounts across multiple customer environments. The second wave, observed May 21st, resulted in VPN Internet Protocol (IP) address assignment following cookie authentication, granting attackers access to internal networks. The eSentire Threat Response Unit (TRU) has identify activity matching the described attacks.
eSentire Threat Intelligence Analysis:
CVE-2026-0257 progressed from initial public disclosure to real-world exploitation in only four days. The public identification and disclosure of this activity did not occur for another twelve days. This timeline highlights the criticality of rapidly patching newly disclosed vulnerabilities, especially those in Internet-facing applications. The widespread adoption of AI models by both security researchers and threat actors, as well as the emergence of frontier models like Mythos, is likely shrinking the patch window, requiring defenders to remediate vulnerabilities faster than ever before.
Organizations are strongly recommended to apply the relevant security patches for all impacted PAN-OS versions as soon as possible. If patching is not immediately feasible, Palo Alto Networks recommends either disabling the authentication override feature entirely or generating a new certificate used exclusively for authentication override.
In response to confirmation of attacks exploiting CVE-2026-0257, the eSentire TRU team created new MDR for Network detections and released a security advisory. Additionally, threat hunts were performed for MDR for Log customers and IP addresses associated with exploitation were blocked for MDR for Network customers via eSentire’s Global Block List. eSentire’s Managed Vulnerability Service (MVS) has a plugin in place to identify devices vulnerable to CVE-2026-0257.
Cisco Vulnerability Disclosures
Bottom Line: This week Cisco has disclosed notable vulnerabilities impacting both Cisco Catalyst SD-WAN Manager and Cisco Unified Communications Manager. One vulnerability from the releases (CVE-2026-20245) is confirmed to be under active exploitation, requiring immediate remediation.
On June 3rd and 4th, 2026, Cisco disclosed two significant vulnerabilities affecting separate enterprise product lines. CVE-2026-20230 (CVSS: 8.6) is a Server-Side Request Forgery (SSRF) vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME). An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device, enabling them to write files to the underlying Operating System, and escalating privileges to root. Cisco’s Product Security Incident Response Team (PSIRT) confirmed publicly available Proof-of-Concept (PoC) exploit code exists but has not identified evidence of active exploitation or targeting at time of disclosure. Exploitation requires the WebDialer service to be active, which is disabled by default.
The second vulnerability, CVE-2026-20245 (CVSS: 7.8), was exploited in the wild, prior to public disclosure. It is an authenticated Remote Code Execution (RCE) vulnerability in Cisco Catalyst SD-WAN Manager. An authenticated attacker with netadmin privileges can exploit the flaw by supplying a specially crafted file to the affected system, executing arbitrary commands as root. At the time of disclosure, Cisco had not released a patch and indicated the fix would be addressed in a future release. The advisory notes that an attacker may exploit the vulnerability if they have previous access to credentials, or via the exploitation of two other previously disclosed Cisco Catalyst SD-WAN vulnerabilities: CVE-2026-20182 and CVE-2026-20127. No other details on real-world exploitation have been shared as of the time of writing.
eSentire Threat Intelligence Analysis:
Cisco Unified CM and Cisco Catalyst SD-WAN Manager are both enterprise-critical infrastructure components. Unified CM underpins voice and collaboration services, while SD-WAN Manager controls wide-area network policy and routing across distributed environments. The compromise of either system could result in a variety of malicious outcomes ranging from lateral movement to disruptions or data theft. Security patches are available to address CVE-2026-20230; due to reports of publicly available PoC, which lowers the barrier for threat actors to make use of the exploit within attacks, relevant patches should be applied immediately.
CVE-2026-20245 presents a more complicated risk, as exploitation is ongoing and security patches are not available. The requirement for netadmin credentials provides some deterrence, but confirmation that threat actors can bypass this through exploitation of previously known and confirmed exploited vulnerabilities increases the risk. Organizations that have not yet applied patches for CVE-2026-20182 need to do so immediately. eSentire’s Threat Intelligence team has published advisories addressing both CVE-2026-20182 and CVE-2026-20127.
eSentire’s Threat Response Unit (TRU) is actively monitoring these vulnerabilities for additional details and detection opportunities.
Joint Five Eyes Report on Chinese Intelligence Operations
Bottom Line: The Five Eyes have published a joint report on a Chinese military intelligence operation targeting individuals with access to classified and sensitive material, with the goal of gathering intelligence to provide strategic and tactical advantages.
On June 3rd, 2026, government agencies part of the Five Eyes alliance published joint bulletins warning about an ongoing fake job recruitment operation conducted by China’s military intelligence services, with the goal of gathering classified or privileged information. The Five Eyes is an intelligence alliance between Australia, Canada, New Zealand, the United Kingdom, and the United States. The published bulletins highlight a social engineering and impersonation campaign, where Chinese intelligence officers are posing as recruiters for consultants, think tanks, and HR firms, placing fake job advertisements and contacting individuals over professional networking and job platform websites.
Resumes that are received for fake job applications are ranked based on the likelihood that the individual would have access to sensitive information. When the threat actors establish contact with the applicants, they have been known to probe about access to government contacts or roles and ask candidates to write trial reports on various political topics, including defence issues and international trade. Additional reports are requested, where the threat actors state that more privileged information is required. Payment is provided for the reports, and individuals may be offered more money in return for “increasingly sensitive information”.
Individuals that have security clearance, with specializations in defence, foreign affairs, or security & intelligence sectors, have been known to be targeted in the campaign. Other targets include military personnel, or those with “indirect or peripheral access” to government information, such as academics, journalists, freelance writers, think tank employees, or “anyone with links to defence, security, policy and economic sectors”. The goal of the campaign is to acquire privileged military, political, or economic intelligence that can “provide China with a strategic and tactical advantage” over other countries.
eSentire Threat Intelligence Analysis:
The Five Eyes’ framing of the objectives for this intelligence gathering campaign over the alliance indicates that the operation was assessed as a long-term, strategic intelligence collection program, rather than as opportunistic or isolated targeting against individual nations. The Canadian Security Intelligence Service (CSIS) indicates that targeted applicants would likely have “no direct access” to classified information, but that the gathered intelligence can still be combined with additional reporting to form a “comprehensive operational picture”. Possible impacts of the campaign can include risk to frontline military personnel, the weakening of economic prosperity, or enable interference within democratic processes.
State-sponsored APT groups have a history of performing cyber espionage campaigns with the goal of gathering information to be used to support and enhance political or military objectives. One example of this type of campaign includes the Russian-linked APT29, who targets cloud services and Software-as-a-Service (SaaS) platforms of “Western governments, diplomatic entities, and critical infrastructure” closely aligned with Russia’s foreign intelligence priorities. An example of these campaigns being used to support military objectives involve Iran-linked threat actors amid the ongoing conflict in the Middle East. The actions of these threat actors highlight that the intelligence gathering operations reported on by the Five Eyes are not solely a technique used by groups linked to China but are commonly seen within campaigns conducted by threat actors from various countries.
The purpose of the joint bulletin is to bring industry awareness to the ongoing operation. Organizations within the impacted industries, or that employ individuals with proximity defence or government work, should educate users on these types of recruitment campaigns. Specifically, organizations in high-risk sectors should educate users on how to identify these attacks and how to report any suspected campaigns to the proper authorities.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
